Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94863
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.221 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAGC=tRnpka_ym=f-xsskjeiPaqahsTEAxPq9=E8Z73KQKeRrHg@mail.gmail.com>
References: <CAGC=tRnpka_ym=f-xsskjeiPaqahsTEAxPq9=E8Z73KQKeRrHg@mail.gmail.com>
Date: Fri, 5 Aug 2016 18:29:20 +0200
Message-ID: <CANUQDChRPd22_2EMOHH0m4FamRVBi7d=AdOioP+HxSpWmT0nxQ@mail.gmail.com>
To: "Charles R. Portwood II" <charlesportwoodii@erianna.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7ba97a108ed46b053955910c
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Argon2 Password Hash
From: me@kelunik.com (Niklas Keller)

--047d7ba97a108ed46b053955910c
Content-Type: text/plain; charset=UTF-8

2016-08-05 14:47 GMT+02:00 Charles R. Portwood II <
charlesportwoodii@erianna.com>:

> Hello Internals,
>
> Due to a couple issue with the original RFC's scope, the RFC for
> introducing Argon2 as an alternative hashing algorithm for the password_*
> functions was closed shortly after starting on Monday.
>
> The following details were adjusted. and I would appreciate your feedback
> before re-opening the vote.
>
>    - The RFC scope was reduced to only cover inclusion in 7.2. This RFC no
>    longer proposes changes to PASSWORD_DEFAULT in 7.4.
>    - Argon2d is not suitable for password hashing, and has been removed to
>    keep in line with the scope goals of the password_* functions.
>    - The configure flag was changed to --with-argon2 to
>    --with-password-argon2 to further clarify the scope of this RFC.
>
> Further rationale for these items is provided in the RFC itself.
>
> The RFC is available at: https://wiki.php.net/rfc/argon2_password_hash.
>
> Thanks to those who emailed me directly to discuss the matter on Monday,
> and for your feedback on these changes.
>
> *Charles R. Portwood II*
>

Hi Charles,

I'd prefer `memory_cost` and `time_cost` over `m_cost` and `t_cost`. Do we
have any reason to use the shorter but less readable names here?

Regards, Niklas

--047d7ba97a108ed46b053955910c--